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DIRECTOR OF CENTRAL INTELLIGENCE 
Security Committee 


Staff Analysis of Comments on 9 August 1979 Draft Revision 
of DCID 1/11 


1. Paragraphil.a of DCID. NSA wants "minimum" sub- 
stituted for "uniform." We are convinced that use of the 
qualifier "minimum" would sanction different policies and 
procedures within the Community. This could result in either 
inadequate or excessive security measures within different 
agencies for shared information of the same level of sen- 
Sitivity. We believe that standards developed for Community 
use should take account of specific security requirements for 
information available to two or more agencies, and then pro- 
vide for uniformity in its protection. Protection of National 
Foreign Intelligence available within a single agency would 
logically be a matter of internal security controls. The 
current, published version of DCID 1/11 does not use the 
qualifier "minimum" in the section of identical substantive 
content. Nothing has come to our attention suggesting that 
the lack of such qualification has caused any problems for 
any Community agency. (U) 


The qualifier "uniform" was specifically agreed 
to by Work Group 1 at the March 1979 SECOM seminar. Such 
was deemed necessary to implement the President's charge 
to the DCI in E.0. 12036 (section 1-601(i)) to “ensure the 
establishment by the Intelligence Community of common security 
and access standards for managing and handling foreign intel- 
ligence systems, information and products" (emphasis added). 
Since the DCI looks to the Security Committee for staff 
support on Community security matters, we believe the 
Committee's charter should reflect the full range of security 
responsibilities assigned to the DCI. (JU) 
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2. Footnote two on page 1 of DCID. NSA objects to the 
term “intelligence information" and to the footnoted definition 
thereof. Conceptually, only "information" can be protected 
against unauthorized disclosure. However, since the concept 
can be dealt with adequately in the footnoted definition, the 
word "information" in conjunction with "intelligence" need 
not appear in the text and has been deleted from the new 
draft. NSA questions the authority of E.0. 12036 definitions 
vis-a-vis those in the "Glossary of Intelligence Terms and 
Definitions." Executive Orders take precedence over any 
other executive branch documents issued at a lower level. 

E.O. 12036 defines "intelligence" as meaning "foreign intel- 
ligence and counterintelligence," both of which terms are 
themselves defined in the Order. Hence, the footnote defines 
"intelligence" by including definitions of all its defined 
parts. In the interests of avoiding possible questions on 
the definition, we have added the term "intelligence product" 
(as defined in E.G. 12036) in part a; the word "processing" 
in part b (to accommodate an Air Force suggestion); and a 
new part c to encompass other categories of information of 
security concern which members may not believe are fully 
subsumed by the other parts of the definition. (U] 


3. Paragraph 1.b of DCID. 


a. DIA recommends the addition of "compromising 
emanations" to line 2, on the grounds that TEMPEST matters 
are a Significant threat to security and that the SECOM 
charter should address them. Emanations security matters 
are handled within the Community by elements often organiza- _ 
tionally separate from those responsible for security. We 
believe existing assignments of responsibility in this field 
should remain. (U) 


b. NSA recommends that line 6 read "...protection 
of intelligence documents..."vice"...intelligence information...." 
E.0. 12036 (section 1-604(b)) makes the DCI responsible for 
"providing policy, guidance and technical assistance to depart- 
ments and agencies regarding protection of intelligence 
information....' (emphasis added) (also see section 1-601(i) 
of the same Order). The National Security Act of 1947 makes 
the DCI responsible (50 USC 403(d)(3)) "for protecting 
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intelligence sources and methods from unauthorized disclosure." 
Only information can be protected against disclosure. Section 
3-403 of E.O. 12065, cited by NSA as precluding a DCI respon- 
sibility to protect intelligence information, pertains only to 
special procedures for the systematic review for declassification 
of specified classes of intelligence information, and specifies 
that the DCI must approve all such procedures for matters 
pertaining to intelligence sources and methods. We do not 
think that NSA's other citations from that Order offer support 
for their objection. Section 4-201 gives the DCI sole respon- 
sibility for authorizing special access programs for matters 
pertaining to intelligence sources and methods. Section 5-2 
makes it clear that implementation of the overall US Govern- 
ment information security program is a cooperative responsibility. 
With regard to NSA's recommended substitute word, we note that 
the protection of documents per se is an archivist function 
directed towards physical conservation. The SECOM should be 
responsibile for security policies and procedures to protect 
information in whatever medium it may appear. We believe the 
DCI needs a single focal point to look to for staff support 

on the broad range of security policy responsibilities assigned 
him by statute and Executive Order. Limiting the SECOM to 
rules and regulations governing marking, wrapping and shipping 
would deny him that support. (U) 


4. Paragraph 1.c of DCID. CIA recommends changing the 
language bearing on the Committee's responsibilities for 
foreign disclosure and public release. We have attempted to 
accommodate that recommendation with appropriately modified 
language in the latest draft. (U) 


5. Paragraph 1.f of DCID. NSA recommends substantial 
deletions. We agree only that the wording should be changed 
jn the interests of clarity. The new draft reflects such. 

We believe that section 4-2 of E.0. 12065 should be referenced 
here to reflect SECOM responsibility for supporting the DCI 

in the exercise of his duty under the Order for special 

access programs pertaining to intelligence sources and 
methods. We further believe that the words "within a frame- 
work of administrative simplicity” are a desirable standard 
against which compartmentation administration procedures 

can be evaluated. (U) 
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6. Paragraph 1.g of DCID. CIA and NSA object to the 
computer security mission including information "communicated" 
by computer. The word was added at the request of the Chair- 
man of the Computer Security Subcommittee, who advised that 
his members were divided on this point. In view of the 
objections, and in the absence of a strong reason for includ- 
ing this aspect in the mission statement, we believe it best 
to revert to the existing DCID language. (U) 


7. Paragraph 2.a of DCID. NSA wants "minimum" substituted 
for “uniform" and another change. Our views are expressed under 
items 1 and 2 above. (U) 


8. Paragraph 2.b of DCID. CIA suggests clarification 
of language bearing on public release. We agree. The draft 
reflects new language. (U) 


9. Paragraph 2.c of DCID. NSA recommends deletion of 
entire paragraph. CIA recommends a change to lines 2 and 35. 
We believe that the first part of this paragraph is essential 
in order to support the President's charge to the DCI in 
E.0. 12036 (section 1-601(h)) to "conduct a program to protect 
against overclassification of foreign intelligence information." 
We consider that the Security Committee is the proper focal 
point for staff support, and that it could and should discharge 
this function through such means as preparation of broad 
classification guidance for the Community. We agree with 
NSA on deletion of the classification challenge function. The 
new draft reflects appropriate changes. (U) 


10. Paragraph 3.b of DCID. NSA recommends that the 
language of the present DCID be retained here. We have made 
an appropriate modification in the new draft. (U) 


1l. Attachment 1. In response to suggestions from 
several members we have paragraph classified this attachment, 
and have applied other markings required by E.0. 12065. (U) 


12. Attachment 1, paragraph 1l.i. CIA asks that the 
word "equipment be added. We have done so. (U) 


13. Attachment ‘2. Army recommends that the title and 
text of this be changed to use the term "automation security" 
vice "computer security." We are reluctant to make such a 
change without the concurrence of the Computer Security Sub- 
committee. Accordingly, we believe current, accepted usage 
should be continued. (U) 
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14. Attachment 2, paragraph 1. CIA and NSA object to 
the "communicated" aspect of this Subcommittee's mission. 
We agree. See item 6 above for discussion. (U) 


15. Attachment 2, paragraph 3. DIA and Army object 
to the assignment of responsibility for computer security 
R§D to both the Computer Security and the R§&D Subcommittees. 
They recommend that it be assigned to the former body. We 
agree that the existing DCID and the draft version are 
deficient in making dual tasking, but we believe that all 
research and development of security concern or applicability 
should be managed and directed by the R&D Subcommittee. We 
have modified the draft accordingly, leaving the Computer 
Security Subcommittee responsible only for recommending R&D 
programs in their area of concern. (U) 


16. Attachment 3, paragraph 1. NSA and CIA recommend i 
that the qualifier "technical" be added before the word 
“guidance” in line 3. We believe such qualification would 

be at variance with the DCI's desire for a single focal 

point to support him in meeting his security responsibilities 
from the President under E.O. 12036. Section 1-604(b} of 

that Order tasks the DCI with "providing policy, guidance 

and technical assistance to departments and agencies regarding 
protection of intelligence information, including information 
that may reveal intelligence sources and methods." There is 
no qualification there on either policy or guidance; only 
with regard to the "how to" function of assistance once policy 
and guidance have been provided. We invite attention to the 
fact that the language of this attachment would have the 
Security Committee provide "guidance" only towards specified 
security objectives (in sub-paragraphs a, b and cj). We do 
not believe that the draft can reasonably be interpreted as 
empowering the Committee to provide policy on what is and 

what is not to be compartmented. (U) 


17. Attachment 3, footnote. NSA asks that footnote 2 
from the current version of the DCID be restored. The foot- 
note not only serves no useful purpose but could be interpreted 
as extending the Committee's authority into areas generally 
considered to be the responsibility of Executive Agents. The 
original footnote 2 was added during the 1974 revision of 
DCID 1/11 at the suggestion of the then Navy member of the 
Committee to provide a written reminder of the need for 
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18. Attachment 3. In response to members' suggestions, 
paragraph and overall classification markings have been. 
applied to meet the requirements of E.0. 12065. (U) 


cin 
19. Attachment 3, paragraph 2. NSA “recommends the i 
qualifier "technical" before the word "guidance." See rm 
discussion under item 16 above. (U) 


20. Attachment 3, paragraph 2.c. NSA recommends the 
lead word "information" be replaced by "document." See 
discussion under item 3.b above. (U) . 

21. Attachment 3, page 2. (NSA and CIA recommend that // 
paragraph 3 in the existing version of attachment 3 to this 
DCID be restored. Work Group 1 at the March 1979 SECOM 
seminar unanimously agreed that this paragraph should be 
deleted on the grounds that it has had the unfortunate effect 
of being interpreted as sanctioning divided security respon- 
sibilities in support.of the DCI. When the DCI reassigned 
the Security Committee under new chairmanship in March 1978, 
he advised the NFIB that the Committee, supported by the 
Community Security Group, would be responsible for advising 
him on all matters of Community concern with respect to 
security policy and management. We believe therefore that 


address measures to protect information, and do not empower 
the Committee to say what shall or shall not be compartmented. 


(U) | 
22. Attachment 3, paragraph 5. 


a. NSA and CIA recommend adding “in coordination HV 
with the appropriate DCI committee" to the first line. We ne 
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consider such language to be superfluous. We believe that 
any recommendations in this area which were not coordinated 
With others having a direct interest would be rejected, and 
properly so. (U) 

te TER 


b. CIA recommends clarification of language bearing 
on public release. We agree. The draft reflects new language. - 
(U) 


23. Attachment 4. DIA and Army recommend that respon- 
sibility for computer security R&D be taken away from the 
R&D Subcommittee and assigned to the Computer Security Sub- 
committee. See discussion under item 15 above. (U) 


24. Attachment 5, footnote. Air Force recommends the 
definition in the note read: "unauthorized disclosure means 
the compromise or possible compromise of intelligence infor- 
mation through public medAdia disclosure. In cases involving 
espionage, the Subcommittee shall provide a damage assessment . 
to the DCI at the conclusion of any investigation by the 
Federal Bureau of Investigation or when any espionage activity 
is disclosed." Air Force argues that references to negligence 
or accident should be deleted as matters to be handled admin- 
istratively by Community agencies, and that FBI/Subcommittee 
roles involving espionage need to be clarified. We believe 
that disclosures of sensitive information are of concern 
whether they result from negligence or from deliberate intent. 
We do not believe that the suggested language on investigations 
is necessary, and we suggest that the draft language, which 
was specifically agreed to by the Subcommittee, be retained. 


(U) 
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